Security audit
Security checks for vulnerabilities and agentic risk
This is a planning skill for scaling systems and organizations, with disclosed local memory and no evidence of hidden execution, network use, or credential handling.
Before installing, be aware that this skill may keep local notes about company, architecture, bottleneck, guardrail, and escalation patterns under ~/scale/. Do not let it store secrets, credentials, payment data, or sensitive identifiers, and review or delete that directory if you do not want durable scaling memory.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
integration: pending
## Scale Context
<!-- What is being scaled and why now -->
<!-- Stage, constraints, and target horizon -->
## Bottleneck Map
The never_ask behavior explicitly directs the skill to 'stop prompting and operate silently' after a user rejects setup prompts. That creates a risk of continued background influence or action without fresh, explicit user confirmation, which undermines transparency and informed consent even if the skill is only maintaining planning state.
The file says to confirm activation in the first exchanges, but then lists conflicting conditions: a broad trigger ('whenever the user discusses growth, bottlenecks, architecture limits, or team capacity') alongside narrower 'only when' constraints. This ambiguity can cause unintended invocation or inconsistent behavior because the scope is not clearly defined.
The skill instructs storing activation preferences in ~/scale/memory.md without clearly notifying the user that data will be retained. Silent persistence creates a privacy and consent risk because users may disclose operational details believing the exchange is ephemeral, while the skill saves reusable context locally for future sessions.
The section on persisting reusable scaling intelligence establishes ongoing retention of user-derived operational context without explicit disclosure or consent. Even though it says not to store secrets, the listed categories can still include sensitive business information such as bottlenecks, interventions, guardrails, and escalation signals, which could expose internal strategy or operational weaknesses if accessed later or stored insecurely.
No suspicious patterns detected.